search

1Password / kubernetes-secrets-injector

MIT License
53 stars 7 forks source link

fix(webhook): config not updated upon changes #31

Closed antoineco closed 1 year ago

antoineco commented 1 year ago

Due to a bug in the mutatingwebhookconfig update logic, the secrets-injector-webhook-config mutatingwebhookconfig object needs to be deleted manually every time the application restarts.

The reason is that, on every startup, a new CA bundle is created and needs to be applied to the existing mutatingwebhookconfig. Right now, the caBunble in the mutatingwebhookconfig retains its original value although the application has regenerated its CA bundle, and TLS handshakes from the Kubernetes control plane fail.

Fixes #32

antoineco commented 1 year ago

@edif2008 @volodymyrZotov this is severe and prevents any Pod in namespaces labeled with secrets-injection=enabled from being created, every time the secrets injector restarts / is relocated. By extension, this affects deployment scale outs and rollouts.

Could one of you please take a look? 🙏 If I can help with providing extra tests, etc. please let me know.